From 416fe4aa843f5aa9b5fb8b527e048268aaf2f0f0 Mon Sep 17 00:00:00 2001
From: ManuA <webmaster@all-solutions.de>
Date: Tue, 28 Jul 2026 16:48:20 +0200
Subject: [PATCH] changed admin look for webauth options

---
 ISHIELD_WEBAUTHN_NOTES.md               | 14 ++++++++++++++
 src/static/templates/admin/settings.hbs | 11 +++++++++++
 2 files changed, 25 insertions(+)

diff --git a/ISHIELD_WEBAUTHN_NOTES.md b/ISHIELD_WEBAUTHN_NOTES.md
index 694f6c0a..4b699533 100644
--- a/ISHIELD_WEBAUTHN_NOTES.md
+++ b/ISHIELD_WEBAUTHN_NOTES.md
@@ -25,6 +25,20 @@ times out. Registering the key without a configured PIN works. YubiKeys with an
 existing PIN work correctly in the same environment, and the iShield works on
 webauthn.io.
 
+The timeout was subsequently reproduced on a clean Debian 13 test instance and
+narrowed down further:
+
+| Existing WebAuthn credentials | Policy | iShield registration |
+| --- | --- | --- |
+| none | `discouraged` | succeeds without PIN |
+| at least one YubiKey | `discouraged` | times out |
+| at least one YubiKey | `preferred` | succeeds with PIN |
+
+The registered YubiKey was physically disconnected during the failing iShield
+attempt. Removing only the YubiKey registration makes the iShield work with
+`discouraged` again. This isolates the additional trigger to the non-empty
+`excludeCredentials` list sent by Vaultwarden, rather than USB device contention.
+
 Vaultwarden deliberately changes the registration and authentication policy to
 `userVerification: discouraged`, since WebAuthn is being used as a second factor.
 The iShield advertises `makeCredUvNotRqd: yes`, so the client is allowed to try
diff --git a/src/static/templates/admin/settings.hbs b/src/static/templates/admin/settings.hbs
index cd5e3ca2..365b5a57 100644
--- a/src/static/templates/admin/settings.hbs
+++ b/src/static/templates/admin/settings.hbs
@@ -26,6 +26,16 @@
                             {{#case type "text" "number" "password"}}
                             <label for="input_{{name}}" class="col-sm-3 col-form-label">{{doc.name}}</label>
                             <div class="col-sm-8">
+                                {{#if (eq name "webauthn_2fa_user_verification")}}
+                                <select class="form-select conf-text" id="input_{{name}}" name="{{name}}">
+                                    <option value="discouraged" {{#if (eq value "discouraged")}}selected{{/if}}>Discouraged</option>
+                                    <option value="preferred" {{#if (eq value "preferred")}}selected{{/if}}>Preferred</option>
+                                </select>
+                                <div class="form-text">
+                                    Discouraged avoids requesting a PIN or biometric check for standard WebAuthn 2FA.
+                                    Preferred asks compatible authenticators for user verification and can improve compatibility with some security keys.
+                                </div>
+                                {{else}}
                                 <div class="input-group">
                                 <input class="form-control conf-{{type}}" id="input_{{name}}" type="{{type}}"
                                     name="{{name}}" value="{{value}}" {{#if default}} placeholder="Default: {{default}}"{{/if}}>
@@ -33,6 +43,7 @@
                                     <button class="btn btn-outline-secondary input-group-text" type="button" data-vw-pw-toggle="input_{{name}}">Show/hide</button>
                                 {{/case}}
                                 </div>
+                                {{/if}}
                             </div>
                             {{/case}}
                             {{#case type "checkbox"}}